commit 63540131ac2c2e9fa97f948c1d7a11de589e268b
author Nan Zhou <nanzhoumails@gmail.com> Thu Nov 25 15:47:52 2021 -0800
committer Nan Zhou <nanzhoumails@gmail.com> Wed Dec 08 22:49:04 2021 +0000
tree c3d12d6bbac1d9b6d66cc21cd365ccf74b5d4598
parent 83e6eab0f088f742528e0860e8105340eb9dfb46

allow X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT

This is needed when installing a server certificate with intermediate
root. Due to the limitation of current implementation, the leaf
certificate has to be the first certificate, followed by any
intermediate root.

This error is similar to the existing one with _LOCALLY.
See https://security.stackexchange.com/questions/144337.

Tested on QEMU.

Signed-off-by: Nan Zhou <nanzhoumails@gmail.com>
Change-Id: I52f3b60c5641f9421cf93a4da628f9b22e4f15d6

certificate.cpp

diff --git a/certificate.cpp b/certificate.cpp
index 7872d81..4e6defc 100644
--- a/certificate.cpp
+++ b/certificate.cpp
@@ -41,6 +41,7 @@
     ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ||                     \
      (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) ||                       \
      (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) ||               \
+     (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT) ||                       \
      (errnum == X509_V_ERR_CERT_UNTRUSTED) ||                                  \
      (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE))